Azure Json File Ownership Set To Root Root

More Info:

The azure.json file should be owned by root:root so only privileged users can access the cloud provider credentials it contains.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS AKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, confirm the file exists and see current ownership:

   ls -l /etc/kubernetes/azure.json
   

   Run on: every worker node.

2. Fix the ownership to root:root:

   sudo chown root:root /etc/kubernetes/azure.json
   

   Run on: every worker node.

3. (Optional but recommended) Restrict permissions to owner read/write only:

   sudo chmod 600 /etc/kubernetes/azure.json
   

   Run on: every worker node.

4. Verify the ownership is now root:root:

   stat -c %U:%G /etc/kubernetes/azure.json
   

   Expected output:

   root:root
   

   Run on: every worker node.

Using kubectl

kubectl cannot change file ownership on node filesystems, including /etc/kubernetes/azure.json; this must be fixed directly on every worker node’s host OS. See the Manual Steps section for the exact commands to run on each node to correct ownership and re‑run the audit.

Automation

#!/usr/bin/env bash
#
# Remediation for:
# CIS AKS 3.1.4 - Ensure that the azure.json file ownership is set to root:root
#
# Scope: run on every worker node (as root)
# Safe to re-run: yes (idempotent)

set -euo pipefail

AZURE_JSON="/etc/kubernetes/azure.json"

echo "=== CIS AKS 3.1.4: Fix azure.json ownership on this node ==="

# 1. Check if file exists
if [ ! -e "$AZURE_JSON" ]; then
  echo "azure.json not found at $AZURE_JSON – nothing to change on this node."
  exit 0
fi

# 2. Show current ownership
current_owner_group="$(stat -c '%U:%G' "$AZURE_JSON")"
echo "Current ownership of $AZURE_JSON: $current_owner_group"

# 3. Apply fix (idempotent: chown to root:root even if already correct)
echo "Setting ownership of $AZURE_JSON to root:root ..."
chown root:root "$AZURE_JSON"

# 4. Verify result
new_owner_group="$(stat -c '%U:%G' "$AZURE_JSON")"
echo "New ownership of $AZURE_JSON: $new_owner_group"

if [ "$new_owner_group" != "root:root" ]; then
  echo "ERROR: Failed to set ownership of $AZURE_JSON to root:root" >&2
  exit 1
fi

echo "SUCCESS: $AZURE_JSON ownership is correctly set to root:root on this node."
exit 0